All rights reserved! [no] Copy, Edit, Alter, Share or Distribute See Licensing on last page. SSL Security. Alternate options for securing your sites

Transcription

1 All rights reserved! [no] Copy, Edit, Alter, Share or Distribute See Licensing on last page SSL Security Alternate options for securing your sites

2 Contents SSL OPTIONS:... 2 Option Considerations:... 3 Available SSL Certs... 4 Shared SSL... 4 Dedicated SSL... 5 Wild Card SSL... 6 Third Party SSL:... 6 Self Signed Certificates:... 7 Free SSL Certificates... 7 RESOURCES... 8 Free SSL resources:... 8 Understanding the Process Non Third Party Process Third Party Process: Third Party Purchasing SSL Installation: What is the SSL / TLS Manager: DEMO SSL / TLS Manager: Generating CSR with a third party cert: Host Specific CSR generation: General Cpanel SSL / TLS Manager CSR creation instructions: Additional CSR Instructions Wrapping up SSL options: Hosting Importance: Types of Hosting Shared hosting Reseller Hosting Dedicated Hosting Demo Access: Host Specific Demos: cpanel Demo: Shelle-K.com 2011 Pg 1

3 SSL OPTIONS: Let s start with going over some of the many options available for your web security. What you need will not be the same for everyone. There are many factors to consider when investing in a SSL certificate. Maintenance of your SSL can be very costly if you jump right in and purchase before weighing out all your possible options, so be sure to really understand what is out there before you invest. We will go over the different types of SSL available, cost comparisons, understand what type of hosting we need depending on the level of support or how much authority you have over manually editing your own certificate. Let s move on to the topic at hand - There are many forms of SSL varying in cost and each hosting provider has their own level of limitations that they allow or only give limited access to. Some allow you to fully create, install and manage while others will only give certain access or none at all. Before actually investing, it is a good idea to understand what you need and the level of authority you want. Ultimately, the more authority you have over your SSL options, the more money you can save in the long run. But this will also require you getting familiar with how to use and perform those SSL procedures if that is the route you want to take. It may sound intimidating at first, but really is not overly complicated once you know how to do it. Shelle-K.com 2011 Pg 2

4 Option Considerations: Determine what is best for your specific circumstances. While going over your options consider these factors 1. Does it need to be accessible to your domain name? Example: 2. What parts of your website does it need to cover? Main domain only: Sub domains included: 3. If you already have a hosting account, what does your hosting allow? 4. If you are considering a new host, do you want full access to managing your own certificate? 5. Do you need it for more than one domain? Does each domain currently have its own cpanel Shelle-K.com 2011 Pg 3

5 Available SSL Certs Below find the various available SSL certificates. Each type of SSL certificate has a different purpose Shared SSL Shared SSL is provided by your hosting provider. This is where your host allows you access to use their SSL certificate. Not in all cases, but in some instances while users are browsing your site over a shared SSL certificate they may be asked to allow the source. Depending on your use, this can be a great option to save you time, money and any frustrations with using dedicated options. Example: Note: Example may be different based on your host carrier and how their server is setup. Cost: Shared SSL is usually included in most hosting plans and do not require any additional costs to use. Looking through the features of your plan or contacting support through your carrier can give you the answer to whether your host provides it in your current host setup. Shelle-K.com 2011 Pg 4

6 Dedicated SSL Having a dedicated SSL is where you have your very own SSL certificate installed on your server. However, your security only covers the one specific domain and any directory level setup within your main directory. Examples: Cost: This will vary based on your host carrier. Some hosts will require you to purchase the certificates that they sell. Others will allow you to use a third party SSL certificate. In most cases, purchasing your own third party certificate is cheaper than purchasing a certificate directly through your host provider. Note: Subdomains are not covered under this form of SSL. Also, you can only have one dedicated SSL per actual cpanel and dedicated IP. What that means is if you have several domains but they are all listed under one cpanel, only one of those domains can actually have a dedicated SSL. You would be required to move any other domain requiring dedicated SSL onto another hosting account with its very own cpanel and dedicated IP. Shelle-K.com 2011 Pg 5

7 Wild Card SSL Wild cards SSL allows you to secure your sub domains also. Example: If you have several domains that you want dedicated hosting on your best option is to get a dedicated server or your very own reseller hosting. Under a reseller hosting account you can setup many different domains all with different cpanel accounts without purchasing several different hosting packages. Cost: Wild card SSL is more expensive. Again, if your host will allow you to purchase a third party certificate you will save money over buying directly from your host provider. Third Party SSL: This is just a way of saying you are buying a SSL certificate that is not purchased directly through your host provider. You will purchase the certificate independently of your host and then take it to your host for installation. Based on your host you may be able to install this yourself or your host may require that they install it for you. In order to purchase a Shelle-K.com 2011 Pg 6

8 third party SSL you will still need to generate a CSR from your host. Most hosts will have instructions on how to generate a CSR for use. Cost: In most cases, this is cheaper than purchasing directly through your host provider Self-Signed Certificates: A self-signed certificate is signed by the owner rather than a security authority. These are free; however they do not actually provide the trusted source. Upon use, you will actually get a generated error message that is displayed in the user s browser that your site is not trusted. The user must accept if they want to continue on with previewing your site. Free SSL Certificates There are ways to generate free SSL certificates for your site. Generally, free certificates will require you to renew the SSL cert more often than a purchased certificate. Time frame may vary based on the actual provider. There are also some providers that will offer a free SSL certificate with the purchase of a specific product or service. Shelle-K.com 2011 Pg 7

9 Note: That even with a free SSL certificate, you will still need a dedicated IP on your hosting account to be able to use it. RESOURCES Below find the various free and relatively cheap SSL certificate resources Free SSL resources: No additional purchase required Startcom Authority: Renew every 3 months InstantSSL: Free 90 day Comodo SSL FreeSSL: Provided by RapidSSL. Offers 1 month free certificates Free with additional purchase Godaddy: 1 Year Free Certificate Hostgator: FREE dedicated SSL & dedicated IP with the purchase of business hosting package (see my additional tutorial on how you can sign up for Hostgator saving even more money than the current advertised discount) Shelle-K.com 2011 Pg 8

10 Rapid SSL: Switch from another provider and they will give you a FREE SSL for 1 year Not FREE but CHEAP alternatives: NameCheap: Purchase new domain & get PositiveSSL for $1.99 NameCheap: PostiveSSL: $8.95 per year / Comodo - RapidSSL $9.95 per year - Select Link / Then click SSL Certificates tab menu and you will have the option to choose either one of these certs These are just a few of your free or inexpensive options available. I will be on the lookout for additional free or alternate cheaper resources. Shelle-K.com 2011 Pg 9

11 QUICK SSL cost comparison on a few of the major host providers: Hostgator Savings: 25% Off hosting code on any new plan Use Code: customer25 See tutorial on how to apply code (discount not applied to SSL) If you purchase or obtain one of the free SSL certs independent of your host provider you will need a host that requires third party hosting options Note: Prices could change at any time. Please see the provider to verify current rate. Prices reflect standard 1 year terms and are in addition to your hosting package. Shelle-K.com 2011 Pg 10

12 Understanding the Process Below find the general steps you will follow in obtaining your dedicated SSL certificate Non Third Party Process Purchasing directly through your hosting provider 1. Purchase or upgrade your account to a dedicated IP 2. Purchase your SSL certificate ** Steps 1 & 2 for some carriers are purchased together 3. Your hosting provider will do the rest (CSR creation, Installation & Management) **Your host may ask you to supply domain registry details for your domain or ask you to fill out a form supplying the necessary details. All this consists of is supplying the registered contact details associated with your domain. **You will most likely also receive an domain validation request at some point while your host is preparing your certificate for installation. This is just to verify your domain. Simply follow the instructions in the it generally consists of clicking a link and inserting the code provided in the . ** In some cases, if you want to manage your cert, depending on your provider you may still have access to your SSL/TLS manager Shelle-K.com 2011 Pg 11

13 Third Party Process: The process for using a third party SSL should go similar to this using most host providers: 1. Purchase or upgrade your account to a dedicated IP 2. Generate a CSR from your hosting company 3. Ask your hosting provider what type of server they have (you will need this information to activate your certificate) 4. Order your SSL cert (you will supply the CSR code and web server type from your host) 5. You will get a domain approval verification (may take a few hours), follow the instructions and confirm. Your certificates will then be generated and delivered to your 6. Install the certificates yourself if the proper features are enabled or give the files to your hosting provider for them to complete the installation ** You should keep a backup of any code or files provided to you by all parties Shelle-K.com 2011 Pg 12

14 Third Party Purchasing There are many vendors to purchase third party certs from. I personally recommend Namecheap. Their prices by far are the cheapest I have found and they make the process simple. Existing Domains: As low as $8.95 per year. New domain purchase: Add a Positive SSL cert for only $1.99 ** Upcoming special: If namecheap gets 5k Facebook likes by July 8 th as a part of their current promotions they will be offering domain names for $1.99 also. See 1.99 domain promotion for more details How to purchase a new domain & get the 1.99 SSL add on: Simply search for an available domain (Namecheap.com) Shelle-K.com 2011 Pg 13

15 Once you find an available domain, add it to your cart. Your cart will automatically give you the option to purchase the Positive SSL cert for $1.99 If you are purchasing a third party certificate, most hosting companies provide instructions on how to generate your CSR certificate (this is needed to purchase your dedicated SSL). Shelle-K.com 2011 Pg 14

16 SSL Installation: Based on your host provider you may or may not be able to install the certificate yourself. More and more providers are limiting the control they allow you to perform for your SSL certificates. However, the ones that provide the SSL / TLS manager within your cpanel will give you more control over the actions you can perform. Justhost, Bluehost and Monsterhost have SSL / TLS Manager options in some of their available plans. Hostgator offers limited SSL / TLS in reseller & dedicated server plans. Other carriers may also offer these services. What is the SSL / TLS Manager: If the option is available within your cpanel this is where you will manage your SSL certificate Here you can generate signing requests, keys, manage the installation and delete any SSL certs no longer needed. Based on your provider, some of these options may be disabled. If all or a portion is disabled, your host needs to perform those actions for you. It is also possible that your host does Shelle-K.com 2011 Pg 15

17 have this in an upgraded hosting package. You can contact them to see if upgrading will give you access or whether they still need to perform the actions for you. Additional resource about using the SSL / TLS Manager: anager Shelle-K.com 2011 Pg 16

18 DEMO SSL / TLS Manager: Want to get a feel for the SSL / TLS Manager before you make a specific purchase? Some host providers may have some of the features disabled but you can get familiar with what the SSL / TLS manager does here. You can then check with your host provider to see what options they offer or find a host that offers the options that you need. Access cpanel SSL / TLS Manager User: x3demob Password: x3demob Demo Access ** Continue reading on or jump to the SSL / TLS Manager training here Generating CSR with a third party cert: If you are purchasing a third party certificate, most hosting companies provide instructions on how to generate your CSR certificate (this is needed to purchase your dedicated SSL). It is best to use the instructions provided by your host when available: Note: When generating your CSR you should have at least a 2048-bit key size. Shelle-K.com 2011 Pg 17

19 Host Specific CSR generation: When generating your CSR your contact details need to match your domain name. If you are uncertain, use any who is lookup database and fill in the details specifically as listed. Not Applicable for third party services: FatCow, Ipage, 1and1.com (only allows third party installation on dedicated servers), Hostgator: Fill out the CSR key generation form: JustHost Contact Support to generate your CSR key BlueHost: You can only install a cert to the primary domain of your account Use the general SSL / TLS Manager instructions GoDaddy: Follow the link below and choose your specific web server for additional instructions Shelle-K.com 2011 Pg 18

20 General cpanel SSL / TLS Manager CSR creation instructions: Remember, you can try this out on the SSL / TLS demo option some features may be disabled but you will get the basic idea and understanding to perform these tasks) Login to your cpanel / Select your SSL / TLS Manager Click on Generate, view, upload or delete private key under Private Key section Enter your domain or select from list (if using third party cert from namecheap 2048 keysize required, change default to 2048) Click the generate button Shelle-K.com 2011 Pg 19

21 Your private key will now display. No need to copy, this will automatically save in your account. Go back to your SSL Manager Click generate, view or delete SSL cert request under CSR section Shelle-K.com 2011 Pg 20

22 Select your host from the drop down box and enter the specific details listed with your domain (this must be correct or your CSR will not generate) Click generate. If all is correct your CSR will display Go back if your receive a blank screen, correct your information and resubmit You now have a CSR. Copy the entire CSR code that displays and paste into the correct area when asked when purchasing your third party certificate. Shelle-K.com 2011 Pg 21

23 Additional CSR Instructions If CSR generation instructions are not available from your host you can get more details below but you should check with your host first. CSR Details: IntranetSSL, PositiveSSL, PostiveSSL WildCard, EssentialSSL, EssentialSSL WildCard, InstantSSL, InstantSSL Pro, InstantSSL Premium, PremiumSSL WildCard, Comodo EV SSL and Comodo EV SGC SSL CSR Details: Rapid SSL & RapidSSL WildCard CSR Details: QuickSSL & QuickSSL Premium CSR Details: VeriSign Certs Wrapping up SSL options: In conclusion, SSL certificates CAN be expensive but you can also find ways to reduce those costs. It ultimately depends on the host provider you use. If you can use a third party SSL cert and if you can install the cert yourself, this will save you money. You can use the free certs, but be prepared to update and renew them often. Shelle-K.com 2011 Pg 22

24 Hosting Importance: Since security is only a portion of your needs, finding the right hosting provider is also important. You want to verify that the provider has all the functionality needed for your specific circumstances. For this reason it s a good idea to try out some demos if you are in search of a new provider or considering switching to take advantage of specific SSL options. Types of Hosting Let s briefly go into the types of hosting available so you can get an understanding of what is available. This will also help you determine the type of hosting account you require for your security needs. Shared hosting Shared hosting is what most individuals use for their hosting services. Hosting companies offer shared space on a server, allowing many users to be on a single server. The hosting provider manages the maintenance to the server itself. The hosting provider will setup and create your single control panel. You are then provided with access to manage all of your domain maintenance needs in that single control Shelle-K.com 2011 Pg 23

25 panel account. Depending on the plan you have purchased, you may have one or many domains under your single control panel. It is important to note that if you purchase a standard shared hosting plan, your single control panel can only house one dedicated SSL certificate for a single domain. All other domains that are listed in that single control panel will not have the ability for a dedicated SSL certificate. ** Some hosting providers can only apply the SSL cert to the primary domain (this is not the case for all providers though). For instance, Hostgator has the option of adding your dedicated IP / SSL to either your primary or add on domains. However, Bluehost can only apply a dedicated IP and SSL to your primary domain. Contact your hosting provider if this is a concern. Reseller Hosting Reseller hosting is generally used by companies reselling hosting services or companies requiring use of individual control panels for separate domains. If you have a need to have more than one control panel, this is your best option. Having the ability to setup more than one control panel will allow you to add dedicated SSL certificates to more than one domain. Purchasing a reseller account is cheaper than purchasing multiple standalone hosting accounts. However, you will manage the setup of adding new control panels and domains. This is not a hard process. I recommend testing out the demos in the demo section if you are unfamiliar with the process. Shelle-K.com 2011 Pg 24

26 Dedicated Hosting Dedicated hosting gives you use of your very own server. You do not share this server with other parties. You also have full control and maintenance over the entire server. Demo Access: While not all providers have demos, there are several providers that do allow access to their demos for browsing and testing functionality. Browsing and trying out some of the options can help you determine what type of hosting package you purchase whether it s a standalone domain cpanel or reseller / whm panel. Note: Not all hosts will have the same features. Features are generally determined by the type of package you purchase. This will allow you to determine what you need and then compare it to your provider available options. Some features may be disabled in the demo due to security purposes. Shelle-K.com 2011 Pg 25

27 Host Specific Demos: If your provider is not listed you can try the original cpanel demos for general functionality (find these listed after the provider specific demos). It is also important to note that even if your specific provider uses cpanel, they can have a custom proprietary design and layout may not be identical. Using your provider demo when available will give you your most up to date layout and available functions. Hostgator Shared Hosting cpanel User: demo Password: demo Access Demo Reseller cpanel: User: rdemo Password: accountpass1 Access Demo Reseller WHM User: rdemo Password: accountpass1 Access Demo Windows Dedicated Hosting (Plesk 9) Demo Options VPS Hosting (Plesk 10) Demo Options Main Demo Access All Demo Options ** The Hostgator demos should automatically log you in. If it does not automatically log you in, enter the username and password for access Shelle-K.com 2011 Pg 26

28 BlueHost Control Panel Demo Access Demo HostMonster Control Panel Demo Access Demo JustHost Control Panel Demo User: democom Password: demodemo Access Demo A few providers that do NOT have demos & use proprietary control panels: Fatcow: has its own proprietary control panel and does not offer a demo Ipage: has the same owner of FatCow hosting. They also have their own proprietary control panel and do not offer a demo 1and1.com has their own proprietary control panel Godaddy.com uses a control panel in conjunction with Cpanel, however they have their own proprietary design and looks nothing like Cpanel. Godaddy does not have a demo but a quick reference guide can be found here (reference guide does not supply much detail). Shelle-K.com 2011 Pg 27

29 cpanel Demo: If your provider does not have a demo and you know it uses cpanel, you can test Cpanel s actual demos below: Remember that not all hosts will provide all the available features. Check with your host to verify which features are enabled for your specific package. Reseller Admin WHM Panel User: demo Password: demo Access Demo Reseller Panel User: x3demoa Password: x3demoa Access Demo Domain cpanel User: x3demob Password: x3demob Access Demo ** The demos should automatically log you in. If it does not automatically log you in, enter the username and password for access Shelle-K.com 2011 Pg 28

30 Conclusion That s SSL and hosting in a nutshell! I hope this has given you enough information to find the right hosting provider and security certificate for your specific needs. Don t forget to try out some of the demos to get familiar with what is available to you. Getting familiar with some of the available options could really save you money, time and frustrations down the road. Upcoming Releases: Make sure you have your address up to date on my subscriber list. I will be releasing how to tutorials and various videos covering some of these procedures. Looking for specific answers?? Request information to be included on upcoming releases here Trouble with broken links? Report them here Reviews: I would greatly appreciate a review in the Warrior Forum! Shelle-K.com 2011 Pg 29

31 Hope this information has come in handy! Thank you again for purchasing my package! I look forward to working with you on an individual level. I am always here for support. In order for me to respond promptly please use my support . Support: development@shelle-k.com Skype: shelle.k Keep up to date with my Latest WSO releases, tutorials and reviews. My New Blog: All new tutorials will soon be released on: Legal Disclaimer: All rights reserved. No part of this tutorial may be reproduced, copied, stored, shared or transmitted in any form, without prior written consent from author. Liability: Every effort has been made to ensure accuracy of the information provided within. Author is not liable for any actions as a result from the information contained within this guide. Reader accepts that technical information evolves and changes, publisher assumes no responsibility for errors, omissions or interpretations on the subject matter. Shelle-K.com 2011 Pg 30